Blog

Last time we looked at what actually happens between git add and git commit — the mechanics of the moment a commit gets created. This time we shift focus to a different kind of question: given a long history of past commits, how do you track down the one that introduced a specific bug? git blame and git bisect both dig into that history, but they’re suited to very different situations. git blame: following one line’s history directly Running git blame <file> lists, for every line in that file, the most recent commit that touched it — hash, author, and date included. If you already suspect a particular line is …

Two articles back, we covered cookie+nonce authentication, and last time we looked at how WordPress’s login cookie is actually a hybrid: signature verification is fully self-contained, but revocation depends on a server-side list of valid tokens. This time we look at the opposite end of the design spectrum: JWT (JSON Web Token), which aims for authentication that is fully stateless — no server-side token list at all. Comparing it against WordPress’s hybrid model makes the trade-off between stateful and stateless authentication much easier to see. What a JWT actually is: three dot-separated parts A JWT looks like a single string split into three parts by dots — xxxxx.yyyyy.zzzzz. These correspond …

Anyone who has wired up a browser-side call to an API on a different domain has probably hit the red has been blocked by CORS policy message in the console — even though the server responded just fine. The browser is the one refusing to hand the response over. This article walks through the same-origin policy that causes this, and what CORS (Cross-Origin Resource Sharing) actually does to relax it safely. What “origin” means Note: an origin is the combination of a URL’s scheme (https://), hostname (wpmm.jp), and port. The path (/blog/, etc.) doesn’t count. https://wpmm.jp and https://en.wpmm.jp are different origins because the hostname differs; https://wpmm.jp and http://wpmm.jp are different …

When building a Python application, configuration values tend to live in one of three places: real OS environment variables, a .env file, or a hard-coded default in the code itself. These three can conflict, and when a value doesn’t seem to be “taking effect,” the cause is usually a misunderstanding of which one wins. This article walks through the resolution order between the three, and why it’s designed the way it is. What a .env file actually is Note: a .env file is a plain text file listing KEY=value pairs, one per line. It’s used to keep environment-specific or sensitive values — API keys, database connection strings — out of …

How Python’s venv Works — Why It Keeps Projects From Fighting Over the System Python Anyone who has worked with Python tooling has run into “virtual environments” (venv) sooner or later. A single command, python3 -m venv .venv, creates a directory that most Python projects treat as a given. What is that directory actually doing, and why has it become such a standard part of the workflow? This post looks at the problem venv solves and how it works under the hood. The Problem: Projects Sharing One Python Installation Working on multiple Python projects on the same machine eventually runs into a conflict: one project needs version 2 of a …

Write code that tries to SSH into several sites in parallel and you’ll quickly run into two questions: how many connections should run at once, and in what order should the results come back? In Python, the foundation for both is the standard library’s queue module, and the concurrent.futures.ThreadPoolExecutor built on top of it. This article looks at how the two relate, and at a property that’s easy to overlook: the order tasks are submitted in is not the same as the order they finish in. What queue.Queue actually is Note: queue.Queue is a FIFO (first-in, first-out) data structure for safely passing items between threads. Conceptually it’s no different from …

Edit a file, run git add ., then git commit -m “…” — for most people these two commands feel like a single operation performed in two keystrokes. But why are they separate commands at all? What happens if you edit the file again after git add but before git commit? Many developers who use Git daily can’t answer either question cleanly. This article walks through the staging area, the mechanism sitting between those two commands. The three-area mental model Note: A common way to understand Git is the three-layer model — the working directory, the staging area (also called the index), and the repository. A change has to pass …